Svpeng can embed itself into a smartphone's Accessibility Services feature, which helps disabled users navigate the device. Last November, 318,000 Androids were attacked by an earlier version, which gained access through Google Adsense advertisements.

The malicious software has been infecting devices since 2013, but the latest upgrade has only affected a small number of devices so far.